The following procedures are to be implemented to ensure that Beloved Care Services meets its policy objective of ensuring that all service users have the same level of privacy and confidentiality as is expected by the rest of the community.
Beloved Care Services will:
1. Ensure that each service user (about whom personal or sensitive information is collected, stored or used), and their family or guardian has access to the policy on Privacy, Dignity and Confidentiality;
2. Advise service users, the family or guardian of the nature of the personal information that Beloved Care Services retains about the service user and that it will be maintained in either paper or electronic formats or both;

3. Advise the service user, the family or guardian of their right to view and access the information that Beloved Care Services keeps in respect of the service user, their right to appeal its relevance and/or accuracy and about the possible use of that information. Beloved Care Services reserves the right to deny access to some information in accordance with the Privacy Act 1988 (Cth) (as amended 2016) and other applicable laws, but undertakes to advise the service user, the family or guardian of the reasons for the denial. Beloved Care Services may provide a synopsis of the relevant information required instead of releasing the file;
4. Only collect personal information to enable Beloved Care Services to provide support and services to its service users. The personal information collected must be directly relevant to Beloved Care Services roles, activities, functions, service delivery and duty of care responsibilities;
5. Only collect sensitive information if it is relevant to providing a service to the individual or is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual;
6. Ensure that the personal and sensitive information collected, used or disclosed is accurate, complete and up-to-date;
7. Take reasonable physical and electronic security measures to protect the information it holds from misuse, loss, unauthorised access, modification or disclosure;
8. Seek the written consent of the service user, family or guardian prior to obtaining information from any other source;
9. Provide training for all employees in the policies and procedures relating to service user file maintenance and security with a view to ensuring that they fully understand their responsibilities in implementing the Privacy, Dignity and Confidentiality policy. Upon appointment, all Beloved Care Services employees, volunteers and Managers will be required to sign a confidentiality declaration;
10.Ensure that personal information is stored securely and is not left on view to unauthorised Beloved Care Services employees or the general public. Service user files are to be stored in lockable filing cabinets in a non-public place in the office and then returned to their proper location as soon as they are no longer required;
11.Ensure that only those Beloved Care Services employees who need access to service user personal information will be granted access. All employees who have access to, and responsibility for, managing service user personal information are to ensure that its privacy and confidentiality are protected. Employees are to ensure that appropriate and relevant service user issues are discussed in the context of professional supervision, debriefing or established communication systems and not:
a) with employees other than those who need to know;
b) in front of the service user if they are not included in the discussion;
c) in public or where discussions may be overheard;
12. Only use or disclose service user personal or sensitive information for the purpose for which it was obtained;
13.Treat the personal and sensitive information collected and stored in strict confidence and not divulge the information to any person not entitled to that information.

However, Beloved Care Services may provide other service providers, contractors, medical and allied health practitioners, regulatory agencies, or others as required by law with service users’ personal and sensitive information as deemed necessary to fulfil our primary responsibility to the service user.
Permission to release service user personal or sensitive information to third parties is only given where there is a legitimate need for the information and is limited to the actual information required. The written consent of the service user’s family, legal guardian, Chief Executive Officer or relevant Executive Director is required in such circumstances;
14.Beloved Care Services will not disclose personal or sensitive information it has collected about service users to a third party for research purposes unless the information is necessary for research or statistical analysis relevant to public health, public safety or the management, funding, or monitoring of disability sector services. Where the identity of the service user is not necessary for research purposes, Beloved Care Services will permanently de-identify the information provided.
The request for information must be in writing and the written consent of the service user, family, legal guardian, Chief Executive Officer or Department Manager is required in such circumstances;
15.Seek the written consent of the service user or family prior to releasing information to any other source. Photographic, video or other identifying images are not to be displayed or aired publicly without the written prior permission of the service user, family or guardian.
All requests from the media for information relating to a service user are to be referred to the Chief Executive Officer. Employees are not permitted to speak to the media on any service user related issue;
16.Ensure that personal information about a service user is only held by Beloved Care Services for as long as it is remains relevant to the delivery of effective services and Beloved Care Services duty of care and legal obligations. Service user files will be periodically reviewed to ensure that personal information that is no longer relevant, and unlikely to be relevant in the future, is culled from files;
17.Take reasonable measures to destroy or permanently remove identification from personal information when it is no longer needed for any purpose for which the information may be used or disclosed;

18.Beloved Care Services will retain all records relating to an individual for the duration of their life under the care of the Beloved Care Services. In the event of the death of a service user or their transfer to another service provider, personal information files will be closed, archived and retained for a period of seven years and then destroyed. If a service user transfers to another service provider, Beloved Care Services will provide copies of all relevant service user personal information to the new agency;
19.Promptly investigate, remedy and document any consumer grievance regarding privacy, dignity or confidentiality in accordance with the ‘Service User Feedback and Complaints Policy’;
20.All service user personal information files remain the property of Beloved Care Services;
21.Ensure any third party or external investigator appointed by the Beloved Care Services will sign a Confidentiality Declaration undertaking to protect the privacy of all service users.
22.Beloved Care Services will report any eligible data breaches to the Office of the Australian Information Commissioner (OAIC) in accordance with the group’s Data Breach Response Plan.